Extracted

• • Target
    allforms.io_new.exe
  • Size 25KB
  • SHA256 56931ecaa47bd2d557ce63e752287538572d5fa2802e4c5606f7360268c5c7e0
  • MD5 a6f318d17c7014768b0c883e84f1848d
  • SHA1 f83d08aec65d405ebdb3a97750b51607c3be5a66
  • SHA512 72ff875109c3b07a6bd3e4f3f12a308b07c25633ec44ec496a3aaa4562f6232a0084b4d27f9120ea05099ae43a27e4093a5bc9fb5b5ed873f71ffdf395a2797b
  • SSDEEP 384:n+9W/96MIZ+HLv4SPgHEm72N2bEOdStNl4+FI0Ux9VTGwNb8G+H+gbz9ySlW5CuW:+c/7rvDPgdaI/QvmyI59Tx8z/BySx
  • TLSH
    T19EC2D64177EDC228E0BF6BB69C7257004775B84B9D16DB0D0EE9908E2E777044AA4BE3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2